GBG is becoming a data controller

At GBG we use the power of data to help companies improve digital access, deliver a seamless experience and establish trust so they can transact quickly, safely and securely with their customers online.   

We are proud to operate to the highest standards, both meeting our obligations under the GDPR to our customers and data subjects whilst also delivering the innovative solutions our customers expect.  

We are continually assessing and evolving our products and as such GBG is pleased to confirm that we will become a data controller for some of the products and services we provide to you, moving forwards. This is a standard that other data businesses may not yet be adhering to, but we are setting a standard that regulators around the world are coming to expect.  

Becoming a controller means we have made changes to our products, continue to update the agreements we have with our data suppliers and customers, and are taking greater responsibility in the sourcing, management and protection of data, ultimately giving our customers greater confidence in the data underpinning our services.

In the GDPR and other privacy regulations a data controller has full control to determine the purposes for processing data and takes full responsibility specifying how the data is used and processed by others, including ensuring legal compliance with data laws.

A data processor simply processes data that the data controller provides to them under specific contractual obligations.

We are asking all customers and suppliers to sign updated terms to ensure that our contracts accurately reflect the roles and responsibilities of each party.

Becoming a data controller, means that GBG is taking greater responsibility in the sourcing, management and protection of data. The significant investment we have made in our global privacy and compliance team means we are better able to support our customers with their own privacy obligations and deliver greater confidence that the data used within our products and services is gathered lawfully. This enables us to continue to innovate for our customers whilst providing peace of mind.

This change is occurring now. Our initial focus has been to update our agreements with our data suppliers.  We have also made changes to our products to align with our position as a data controller. We are now beginning the process of updating our existing customer agreements in a phased approach.

You will have been asked to sign a new agreement if you are approaching your contract renewal date or if you are mid-term but contracted with us on one of our older agreements, many of which predate the introduction of GDPR.

As part of our move to becoming a data controller we’ve taken the opportunity to transform our contracting process.  We’ve had to make necessary changes to the privacy and data protection obligations to reflect our status as a data controller.  We’ve also taken the opportunity to listen to customer feedback and have made further improvements designed to make contracting with us quicker and easier for you. 

The contracts that we have in place between our customers and our data partners, clearly set out the roles and responsibilities of each party in relation to responses to subject access requests. You as GBG’s customer will be an independent data controller and will continue to have the same responsibility to data subjects as you do today.  GBG will continue to support you were needed. Going forward, GBG will also act an independent data controller. This means that GBG also needs to respond directly to individuals and to achieve this we will need greater visibility of the data we have processed and who we have shared this with.

GBG has invested significantly in our Privacy and Data Compliance team, which now has over 18 members with combined privacy experience of over 200 years, ensuring that the data that is supplied to GBG, the foundation of our products and services, remains compliant with all applicable legislation, both now and in the future.   We also need to understand how and why our customers use our products and services and will therefore be capturing a Customer Use Case.  As a controller, GBG has an obligation to our customers, partners and data subjects to make sure that the use of our products is in line with the GDPR and to achieve this we need to understand how and why those products are used.

The Information Commissioner’s Office, ICO, is the UK’s independent data protection regulatory authority set up to uphold information rights in the public interest. You can find out about the ICO by clicking ico.org.uk

Please email controller@gbgplc.com or speak to your Customer Success Manager.